view.exe threat report

MD5 81fd3f5400d27c37404c76603cbc71d3
Latest seen 2022-06-06 23:37:49 (3 years ago)
First seen 2022-06-06 23:37:49 (3 years ago)
Size 1 MB
Product InTouch

GridinSoft Anti-Malware detection

Detected by GridinSoft before you download

The current ThreatInfo record shows this exact file hash detected as Trojan.Generic. Download GridinSoft Anti-Malware to scan the device, confirm whether this file is present, and remove the detected object if it is found.

Detection name
Trojan.Generic
Recommended action
Scan and remove
Last analysis
2022-06-06 23:37:49 (3 years ago)
File hash
81fd3f5400d27c37404c76603cbc71d3
Download Anti-Malware

Why it matters

Why GridinSoft flags this file

Detection

GridinSoft identifies the sample as Trojan.Generic.

Timeline

First seen 2022-06-06 23:37:49 (3 years ago); latest analysis 2022-06-06 23:37:49 (3 years ago).

Publisher context

Company metadata: Invensys Systems, Inc.. Product metadata: InTouch.

Observed locations

ThreatInfo has seen this file in user or system paths listed below. Unexpected locations increase the need for local verification.

Recommended action

What to do next

  1. Compare the MD5 above with the file found on the device.
  2. Check whether the file appears in the observed locations or under one of the alternate names.
  3. Run GridinSoft Anti-Malware to confirm the detection and remove the file if it is present.

view.exe is a Windows file recorded in the ThreatInfo database. It is associated with InTouch. The reported company name is Invensys Systems, Inc.. The current detection status is Trojan.Generic, based on the latest analysis from 2022-06-06 23:37:49 (3 years ago).

If view.exe appears on your computer unexpectedly, treat it as suspicious. Check its location, digital signature, and recent system changes before allowing it to run. A full anti-malware scan is recommended when this file is detected as Trojan.Generic.

Product Name: InTouch
Company Name: Invensys Systems, Inc.
MD5: 81fd3f5400d27c37404c76603cbc71d3
Size: 1 MB
First Published: 2022-06-06 23:37:49 (3 years ago)
Latest Published: 2022-06-06 23:37:49 (3 years ago)
Status: Trojan.Generic (on last analysis)
Analysis Date: 2022-06-06 23:37:49 (3 years ago)
view.exe detection screenshot

The screenshot is a visual record of a GridinSoft Anti-Malware detection for this sample. Use the hash and metadata above as the primary identifiers when comparing the file on your system.

%sysdrive%\04_colombia-docencia uan\curso 2020\ii semestre\23 sistemas scada\09 simulador virtual scadas\intouch\wonderware_intouch_10 by @elion24\wonderware intouch 10.0\wonderware

ThreatInfo has observed view.exe in the locations listed above. Files found in temporary folders, user profile folders, startup locations, or unusual application directories should be reviewed more carefully than files installed under a known program directory.

100.0%

The strongest geographic signal for this file is Colombia with 100.0% of observed hits. Geographic distribution can help identify targeted campaigns, regional software bundles, or where a file is most commonly reported.

Windows 8.1 100.0%

The most common operating system signal for view.exe is Windows 8.1 with 100.0% of observed hits. If your system differs from the common profile, check whether the file was introduced by a specific installer, archive, or removable device.

view.exe is identified as pe for 32 systems. The subsystem is Windows GUI. PE header values are useful for triage, especially when they do not match the expected publisher, product, or release timeline.

Subsystem: Windows GUI
PE Type: pe
OS Bitness: 32
Image Base: 0x00400000
Entry Address: 0x000b4678

PE Sections:

Name Size of data MD5
.text 737280 a0372e8f2c3527ca9f3312beec36ca96
VIEWWNDP 20480 c8a4c2046216b267ce9825044a1f2668
DBCHGMSG 4096 0560a50469d36c121a2435b6cc7f9cc1
VUINIT_T 4096 63b009a22a03ecc7e245076520cf5285
TIMEREVE 4096 e4758c426ce50d6c2bcd6659d1377141
UPDATE_L 4096 81deec0cbbbb3eea16eb03d02d1d624a
CHG_TEXT 4096 1e9f0351d0493416b43317f3cea38e39
TREND_UP 8192 ed57a2e26042caaaba8b5d970d314208
CONSOLID 4096 166438ff9bf628a04129710622dae11a
CHG_VISI 4096 ed661c1465b992c0dbaf6023cf9c5434
CHG_DISA 4096 1627f2cf0b99886b24c25ac79831d1e0
MOUSE_TE 16384 811e329c2d93120da636de12742fc214
MOUSEMOV 4096 64f3feb96f83866fd52d46c055af72fc
SLIDER_T 4096 0722258757d698a47254962cbf6a3ccc
CHECKTOU 4096 934ed1530e3b2f5fb9a899cdd84d3160
VUINPDLG 4096 ea6901a1b4a7d2f41a38674b28da03be
CHECKTOU 4096 32f1823e7e394588e614f599fdb35d10
SHOWHIDE 4096 c153462b9a8d3f98aef7374da022f594
TOUCHFRA 4096 df146458fa492505bb831a3f85f8e66b
ARROWKEY 4096 705a6509fec2ddc1dda59513288a62aa
VURARE_T 4096 d60825781f56880e8ba127a834b9150d
VUMENU_T 4096 fcd3d2fdfa9a1cc2a2490928514d2106
VUDELETE 4096 117fedbe38d137f0fb60448bf15e1276
FASTLOAD 4096 5e687339414e20f4c6df1d8d1575ac79
VULDWIN_ 4096 77f0e5cb1ab4d433da290cb643e34064
CHECK_TR 4096 f5e6b100a6341ca338482bba18342736
UPDATE_C 4096 cb788a40989e3645cc95153370faa914
VUPAINT_ 4096 1374ea7d28b3a3e17f709f25e94f271d
VIEWSETB 4096 7a52c0809c045fd5817389a4d00b9eb1
CHG_HEIG 4096 73ab627c8316373031f10d9688162a62
CHG_WIDT 4096 a446d7d313167210e0a93f8d4710a36d
CHG_HLOC 4096 1e1c305013523fbacdb329f579e727f2
CHG_VLOC 4096 5ce1499645c64a918a55292bfd0ad785
CHG_LOCA 4096 270ec134af3022104effc89f11e4e236
UPDATECO 4096 717bd407ef4bed5f903e7dba6270a7c6
UPDATECO 4096 cc4970ff99b7f2b05cd23ea36b845d8f
UPDATECO 4096 2b3420a8bd27b2ba1a8536eefae91a42
OF_INIT 4096 1b0224e385ad5b54b4cc62308cdd8b7d
WDWINDEX 4096 a271918c5c1dc50b9708fcca8ab1b4f6
WDWINDEX 4096 bd7bbb33b55c25fbd3ea49de04871582
WDWINDEX 4096 9fb630c988b2802115eb5fe1b3b9ff6b
FASTLOAD 4096 b71287490a40429a4df12b1e46f736f5
RTOPS_FU 4096 dd9ab98033f1875655f4d261ff1d1a8c
GETSAMPL 4096 d1760b6934c7e7e4651d804473c80bc7
TRENDLOA 4096 0ccb5456a9dd9c0b4dee0ab001a4d3be
TRENDDRA 4096 dd01b1b1aa89c65968edae42013eb63a
.rdata 28672 dfcc012745643ea3a3df5de5a1d4659f
.data 73728 753e9579f4260f3517777fd6573c19a7
.rsrc 192512 6159fe8ae8eda264847388353bcd3c21
.reloc 61440 f4131ab2971bd4a809e3a658702df1a8

PE section names and hashes can reveal packing, injected resources, or unusual build artifacts. Sections with uncommon names, very large raw data, or hashes that differ from a trusted copy deserve additional review.

More information: